This domain is about 18% of the exam. It asks for security concepts and for matching a threat or need to the right Google Cloud product. You will not configure anything. Know the one-line job of each product, and the language of shared responsibility, zero trust and defense in depth.
Threats and their business impact
| Threat | What it is | Business impact |
|---|---|---|
| DDoS | Flooding a service with traffic to make it unavailable | Outage, lost revenue |
| Ransomware | Malware that encrypts data and demands payment | Operations halted, data loss, extortion |
| Cryptomining | Attackers hijack compute to mine cryptocurrency | Surprise bills, degraded performance |
| Malware / viruses | Malicious software that steals, damages or spies | Data theft, downtime |
| Phishing | Deceptive messages that trick people into giving credentials or running malware | Account compromise. The most common entry point |
| Misconfiguration | Errors such as a public storage bucket or an open firewall | Data exposure. A leading cause of cloud breaches |
| Unsecured third-party systems | Weakness in suppliers or partners (supply chain) | Indirect breach |
| Physical damage | Fire, flood, theft at data centres | Hardware and data loss |
| LLM attacks | Prompt injection, data leakage, jailbreaks, poisoned training data against AI systems | Wrong or harmful AI output, exposed sensitive data |
Consequences to name: financial loss, regulatory fines, reputational damage, lost customer trust, legal liability.
Cloud vs on-premises security
- On premises, the organization secures everything: buildings, hardware, network, software.
- In the cloud, security is a shared responsibility. The provider secures the underlying infrastructure (data centres, hardware, network, hypervisor). The customer secures what they put in it: data, identities, access, configuration and their own applications. How much falls to the customer depends on the service model (more with IaaS, less with SaaS).
- Google describes shared fate: it provides secure blueprints, defaults and guidance and shares in the outcome rather than only drawing a line of responsibility.
- Cloud providers can invest in security at a scale most organizations cannot (specialised staff, custom hardware, global threat visibility). A cloud is not insecure by nature, and most cloud incidents come from customer misconfiguration.
Core security concepts
| Concept | Meaning |
|---|---|
| Confidentiality | Only authorised people can see data |
| Integrity | Data stays accurate and unaltered |
| Availability | Systems and data are accessible when needed (the CIA triad) |
| Control | The organization decides who accesses what, where data lives |
| Compliance | Meeting legal and industry rules (GDPR, HIPAA, PCI DSS, ISO 27001) |
| Data loss prevention (DLP) | Finding, classifying and protecting sensitive data from leaking |
| Privileged access | Powerful accounts (admins) that need extra protection and monitoring |
| Least privilege | Give people only the access needed for their job, no more |
| Zero-trust architecture | “Never trust, always verify”: no user or device is trusted just because it is on the network; every request is authenticated, authorised and checked. Google’s implementation is BeyondCorp |
| Security by default | Safe settings are on from the start (for example encryption at rest automatic) |
| Security posture | Overall strength of defences and how well risks are managed |
| Cyber resilience | Ability to keep operating, and recover quickly, during and after an attack |
| Firewall | Filters network traffic by rules, allowing or blocking |
| Encryption / decryption | Scrambling data with a key so it is unreadable; reversing it with the key |
Encryption by data state
| State | Meaning | How it is protected |
|---|---|---|
| At rest | Stored on disk or in a database | Google Cloud encrypts all customer data at rest by default |
| In transit | Moving across a network | TLS on connections; Google encrypts traffic between its data centres and offers VPN and Interconnect for private links |
| In use | Being processed in memory | Confidential Computing keeps data encrypted even while in use, inside hardware-isolated environments |
Key management options: Google-managed keys (default), Customer-managed encryption keys (CMEK) in Cloud KMS, and customer-supplied or external keys (Cloud EKM) held outside Google for maximum control.
Authentication, authorization and auditing
| Term | Question | Example |
|---|---|---|
| Authentication (authn) | Who are you? | Password plus multi-factor authentication (MFA) or 2-step verification (2SV) |
| Authorization (authz) | What are you allowed to do? | IAM roles and policies |
| Auditing | What did you do? | Cloud Audit Logs record who did what, where and when |
MFA and 2SV add a second proof (a code, a phone prompt, a security key) so a stolen password alone is not enough. Security keys resist phishing best. Mixing up authentication and authorization is a classic exam trap: logging in is authentication; deciding what you can then open is authorization.
Security operations (SecOps) terms
- Security posture: the current state of your protections and risks.
- Threat intelligence: information about attackers, their methods and indicators, used to anticipate and detect attacks.
- Threat response: investigating and containing an attack, then recovering.
Google as part of your security team
Google’s approach is defense in depth: many layers, so if one fails others still protect.
Secure by design infrastructure
Layers from bottom up: physical premises (proprietary data centres with strict access controls) -> purpose-built servers and networking with custom security hardware (Titan chips verify boot integrity) and software -> secure boot and OS -> storage encryption -> identity -> network and application controls -> operations and monitoring. Google builds its own servers and network rather than buying generic equipment, so it controls the whole stack.
Securing every layer of the AI stack
Security covers: infrastructure, data (encrypted, governed), models (protected from theft and tampering), platform (secure development and access controls) and agents (controlled tool use and permissions). The security offerings that help are below.
Google Threat Intelligence
Gives proactive insight into attackers and active campaigns. Its analysis comes from three unique sources:
- Google’s vast global visibility (billions of devices and users protected).
- Mandiant’s frontline incident response experience on major breaches.
- VirusTotal’s crowdsourced malware and threat detection.
Security Command Center (SCC)
The cloud security posture and risk platform. It:
- Discovers assets and finds misconfigurations and vulnerabilities.
- Prioritises risks (including attack-path simulation).
- Detects threats and helps remediate.
- Supports compliance monitoring and works across Google Cloud (and multicloud in higher tiers).
Pick SCC when the scenario is “see and fix security risks and misconfigurations across my cloud environment”.
Google Security Operations
A unified, cloud-native SecOps platform (SIEM, SOAR and threat intelligence together). It ingests telemetry at scale from many sources, applies detection and threat intelligence and speeds up detection, investigation and response. Gemini in Google Security Operations adds AI help: natural-language search, case summaries and suggested response.
AI-assisted and AI-focused security
| Offering | Purpose |
|---|---|
| Gemini in Security (such as in Google Security Operations, SCC) | Uses AI to help defenders investigate and respond faster |
| AI Protection | Discover and protect AI assets: find AI workloads and models, assess risk, defend against AI threats |
| Model Armor | Screens prompts and model responses for prompt injection, jailbreaks, harmful content and sensitive data leakage |
Other security offerings
| Product | Job |
|---|---|
| Virtual Private Cloud (VPC) | Your own isolated, global private network in Google Cloud, with subnets and routing |
| Firewalls (Cloud NGFW, VPC firewall rules) | Control which traffic is allowed to or from resources |
| Cloud VPN | Encrypted tunnel over the internet between your network and Google Cloud |
| Cloud Interconnect | Private, dedicated high-bandwidth connection that bypasses the public internet |
| Cloud Armor | Web application firewall and DDoS protection at the edge |
| Cloud Logging / Audit Logs | Collect and retain logs; record admin and data access for audits |
| Identity and Access Management (IAM) | Control who can do what on which resource; roles and policies |
| Sensitive Data Protection | Discover, classify and mask or tokenise sensitive data (formerly Cloud DLP); this is Google’s DLP product |
| Confidential Computing | Encrypts data in use in memory |
| Certificate Manager | Provision and manage TLS certificates for load balancers at scale |
| Identity-Aware Proxy (IAP) | Protects apps by checking user identity and context before access, without a VPN; a zero-trust building block |
| Cloud KMS | Create and manage encryption keys |
| Secret Manager | Store API keys, passwords and certificates safely |
| Chrome Enterprise Premium | Zero-trust access and threat protection for the browser |
Matching tips: DDoS or web attacks -> Cloud Armor. Private connection to data centre -> Interconnect (dedicated) or VPN (cheap, encrypted over internet). Employees reaching internal apps without VPN -> IAP (BeyondCorp). Hide or find personal data -> Sensitive Data Protection. Data encrypted while being processed -> Confidential Computing.
How Google earns and maintains trust
| Practice | Meaning |
|---|---|
| Transparency reports | Publishing how often governments request user data and how Google responds |
| Third-party audits and certifications | Independent verification (ISO 27001, SOC 2 and 3, PCI DSS, FedRAMP and others) with reports available to customers |
| Digital sovereignty | Customers keep control over data, operations and software, meeting local laws. Tools include Sovereign Cloud offerings, Assured Workloads, external key control and Google Distributed Cloud |
| Data residency | Choose the region where data is stored and processed |
| Compliance resources | Compliance resource centre and Compliance Manager features, certifications and control mappings to help customers demonstrate compliance |
| Access Transparency and Access Approval | Logs of Google staff access to your content, and the option to approve it first |
| Customer data ownership | The customer owns their data; Google does not use customer data for advertising |
Exam checklist
- Know the threats list and that misconfiguration and phishing are the most common causes.
- Shared responsibility: Google secures infrastructure; customer secures data, identities, configuration. Shared fate adds guidance and blueprints.
- Zero trust = never trust, always verify (BeyondCorp, IAP). Least privilege = minimum access.
- Encryption states: at rest (default), in transit (TLS), in use (Confidential Computing).
- Authentication = who; authorization = what; auditing = what you did.
- Threat Intelligence draws on Google, Mandiant and VirusTotal.
- SCC = posture and risk; Google Security Operations = SIEM/SOAR with Gemini; Model Armor and AI Protection = AI security.
- Cloud Armor = WAF and DDoS; Interconnect vs VPN; Sensitive Data Protection = DLP.
- Trust: transparency reports, audits, sovereignty, residency, Access Transparency.